The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
Various approaches currently exist for monitoring the condition of network components. Some approaches monitor Management Information Base (MIB) objects. A MIB object is a variable whose value indicates a condition of a network component. The value of the MIB object may trigger a notification (e.g., special event) when a threshold that indicates a status or condition of the component is crossed by that value. One or more MIB objects (e.g., object status) may be associated with each component of a network. For example, there may be a MIB object associated with a CPU. The value of the CPU MIB object describes the state of the CPU (e.g., active or inactive). The value of a MIB object may be changed or retrieved using network management protocol commands, such as Simple Network Management Protocol (SNMP) commands or Common Management Information Protocol (CMIP) commands.
Based on the values of the MIB objects of network components, network management systems for applications using the SNMP and CMIP management protocols may monitor the status of network components. The values of MIB objects may be polled by such systems or applications using SNMP or CMIP, or traps or notifications, respectively, may be sent by components to the managing applications using SNMP, CMIP, or other transport supports. However, the current approaches have several shortcomings. Namely, the thresholding techniques that are used to define states in the systems or applications do not present a complete picture of network behavior. More specifically, the quantity of values of MIB objects that is available to the management system or application may be insufficient to paint a complete picture of the network behavior. Additionally, techniques for monitoring values of MIB objects such as polling do not allow the value of the MIB object to be received by system management protocols in a timely fashion.
Current threshold concepts, which are used to classify MIB values, focus on known states of a network component and transitions, but do not consider composite transitions among multiple states. Additionally, current threshold concepts are used to capture desirable behavior, and are not directed toward capturing illegal or undesirable behavior. Therefore, current approaches do not consider the behavior of an entire component or sub-networks. Due to the foregoing shortcomings, network management applications are unaware of certain network problems, or learn about problems too late. As a result, systems or applications that use them are unable to rectify certain global problems in communication networks.
Classically, thresholds have been established based on a status variable, a comparison, and an optional condition string for a particular probe variable. If the comparison triggers, that is if the expression comparing the probe variable to a constant or other variable is true, then the device is changed to the corresponding status. State variables, which are also sometimes referred to as “attributes”, may belong to continuous spaces, such as time intervals, or discrete spaces, such as numerical or alphanumerical sets. Among the values of a given space, one can define many thresholds. However, these approaches for using thresholds have numerous disadvantages. For example, as mentioned above, these approaches do not consider composite transitions, and, therefore, do not consider the entire behavior of a component or a network.
Based on the foregoing, there is a clear need for a means of capturing illegal and undesirable network behavior in a manner that avoids the aforementioned problems.